What is CVE-2023-50224?

CVE-2023-50224 is a medium-severity vulnerability in TP-Link Archer C1900 Firmware, classified under Authentication Bypass by Spoofing. CVSS score: 6.5/10. Published 2024-05-03.

How severe is CVE-2023-50224?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Is CVE-2023-50224 known to be exploited?

Yes. CVE-2023-50224 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-09-03), indicating it is being actively exploited. 4 public proof-of-concept repositories are indexed.

Vulnerability in TP-Link Archer C1900 Firmware

CVE-2023-50224

TP-Link TL-WR841N dropbearpwd Improper Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from improper authentication. An attacker can leverage this vulnerability to disclose stored credentials, leading to further compromise. Was ZDI-CAN-19899.

EPSS: 0.174 (96.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Affected products

Weakness classification (CWE)

CWE-290 — Authentication Bypass by Spoofing

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2025-09-03. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2025-09-24.

Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Public proof-of-concept exploits

References

zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)
zdi-disclosures@trendmicro.com (Product, vendor-advisory)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)
zdi-disclosures@trendmicro.com (Vendor Advisory)

Frequently asked questions

What is CVE-2023-50224?: CVE-2023-50224 is a medium-severity vulnerability in TP-Link Archer C1900 Firmware, classified under Authentication Bypass by Spoofing. CVSS score: 6.5/10. Published 2024-05-03.
How severe is CVE-2023-50224?: Medium severity. CVSS v3 base score is 6.5 out of 10.
Is CVE-2023-50224 known to be exploited?: Yes. CVE-2023-50224 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2025-09-03), indicating it is being actively exploited. 4 public proof-of-concept repositories are indexed.